PRIVACY POLICY

Company Privacy Policy RPC LASER, LLC.

DEFINITIONS OF TERMS

Privacy Policy

The Privacy Policy is an internal company document RPC LASER, LLC. ​(hereinafter: the processor) and apply to all legal relationships between the processor and service providers (hereinafter: the controller). This Act sets forth the rights and obligations of the processor and the controller regarding the management and processing of individuals’ personal data.

Personal information

Personal data means any information relating to an identified or identifiable individual who is a natural person. An identified individual is one whose personal data is identified and processed in accordance with the purposes specified by the controller. An identifiable individual is one who can be identified, directly or indirectly, and whose personal data may be processed in accordance with the purposes determined by the controller.

Individual

An individual is any natural person whose personal data is processed on a legal or contractual basis between the controller and that individual, or on the basis of explicit consent given by the individual to the controller.

Operator

The controller determines the purposes and means of processing within the scope of its registered activities and/or statutory authority. The individual is informed in advance of who is the controller of their personal data and who is the processor of their personal data.

Processor

The processor processes individuals’ personal data on behalf of the controller, in accordance with the controller’s instructions, within the scope of lawful purposes and methods of processing.

Subcontractor

A subprocessor processes individuals’ personal data on behalf of and in accordance with the instructions of the processor, within the scope of the lawful purposes and methods of processing.

Processing

The processing of personal data means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organizing, structuring, storing, adapting or altering, retrieving, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Restrictions on Processing

Restriction of processing refers to the marking of stored personal data in order to limit its future processing.

Creating Profiles

Profiling means any form of automated processing of personal data that involves the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyze or predict that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that individual.

Pseudonymization

Pseudonymization means processing personal data in such a way that, without additional information, the personal data can no longer be attributed to a specific individual to whom the personal data relates, provided that such information is stored separately and is subject to technical and organizational measures to ensure that,
that personal data is not attributed to a specific or identifiable individual.

An Individual's Consent

The consent of the data subject means any freely given, specific, informed, and unambiguous expression of will by the data subject, by which the data subject, through a statement or a clear affirmative action, consents to the processing of personal data relating to him or her.

Breach of Personal Data Protection

A personal data breach is a security breach that results in the intentional or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that is transmitted, stored, or otherwise processed.

PROCESSING OF PERSONAL DATA

Processor Information

COMPANY NAME: RPC LASER, LLC.
COMPANY ADDRESS: Sela pri Šmarju 17, Sela pri Šmarju, 1290 Grosuplje
Registration Number: 9376437000
Tax ID Number: 60134607
The person responsible for providing information regarding this document and the protection of personal data is: Klemen Pompe

Subcontractors

The processor has entered into contracts for the further processing of personal data belonging to individuals of a specific controller in cases where, to perform its services, it engages external processors who are subprocessors of the controller. The processor is responsible for selecting subprocessors and ensures that
are obligated to provide a level of personal data protection that is equal to or higher than that required by Slovenian regulations and European Union regulations. The processor shall inform the controller of its existing processors and of any replacement of processors or engagement of new processors. It shall do so by announcing the publication of new privacy terms, in which it shall list the new processors and give the controller thirty days to comment on the changes, approve them, or object to them.

Legal Basis for the Processing of Personal Data

The processor has a legal basis for processing the personal data of individuals belonging to a specific controller, as set forth in a contract previously concluded between the controller and the processor or based on another agreement regarding the provision of services.

The processor is responsible for ensuring that the controllers are familiar with this document and the processor’s other documents, to the extent that they govern the processing of individuals’ personal data and/or the terms and conditions for the performance of the contracted services.

The controller is responsible for ensuring that there is an appropriate legal basis for the processing of personal data (legitimate interest, contractual interest, and/or the individual’s explicit consent).

Types of Personal Data

The processor processes only the personal data provided to it by the controller. The processor never processes any other personal data belonging to individuals associated with a specific controller.

Purposes of Processing Personal Data

A processor processes the personal data of individuals belonging to a specific controller only for the purposes for which the controller has instructed it to do so. A processor never processes the personal data of individuals belonging to a specific controller for any other purposes.

The Role of the Administrator

The controller is required to provide the processor with instructions regarding the processing of the personal data of the individuals whose data it controls. The controller must clearly and unambiguously inform the processor of the types of personal data it may process and the purposes for which it may do so.

Documented instructions from the operator

Under this provision, the controller is required to specify to the processor the scope and duration of the processing of personal data, the nature and purpose of the processing, the types of personal data, and the categories of individuals to whom the personal data relate.

The controller’s instructions must be documented; they may be provided in writing via regular mail or email. In the case of verbal instructions, the processor shall also request written confirmation via regular mail or email.

The processor is not responsible for the lawfulness of the instructions it receives from the controller regarding the processing of personal data of individuals under that controller’s control.

Data Confidentiality

The data processor ensures that persons authorized to process personal data are bound by a confidentiality obligation or are subject to such an obligation under applicable law. The processor has adopted internal Rules on the Protection of Personal Data and obtains a written confidentiality agreement from all employees and external collaborators, acknowledgment of the policy, and the appropriate security measures implemented by the processor to ensure an adequate level of data security.

Individual Rights

The processor shall take the necessary technical measures to ensure, in accordance with the controller’s instructions and to the extent permitted by law, provides the support, technical solutions, and final data that the controller needs when individuals exercise one or more of their rights under the law: the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object.

Deletion or Transfer of Data

Based on prior documented instructions from the controller, the processor shall delete or return all personal data to the controller upon completion of the service it performs for the controller and shall destroy any existing copies, except in cases where data retention is required by law.

Access to Information

The processor shall provide the controller with all information necessary to demonstrate compliance with the obligations under this Act and applicable law, and shall enable the controller or another auditor authorized by the controller to conduct audits, including inspections, and shall cooperate in such activities.

SECURITY OF PERSONAL DATA PROCESSING

Processing Security

The data processor and data controller shall, taking into account the latest technological developments and the costs of implementation, as well as the nature, scope, circumstances, and purposes of the processing, as well as the risks to the rights and freedoms of individuals, which vary in likelihood and severity, the controller and processor shall, by implementing appropriate technical and organizational measures, ensure a level of security appropriate to the risk, including, among other things, measures covering:

  • pseudonymization and encryption of personal data,
  • the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services,
  • the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident,
  • procedures for the regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures designed to ensure the security of processing.

In determining the appropriate level of security, particular consideration is given to the risks posed by the processing, in particular those arising from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data that is transmitted, stored, or otherwise processed.

Data Protection Officer

The data controller is not required to appoint a data protection officer because it does not process personal data as a public authority or body, nor does it, in the course of its core activities, carry out processing that, by virtue of its nature, scope, and/or purposes, would require and the controller’s core business does not involve
large-scale processing of specific categories of personal data.

Safety Measures

The processor ensures that appropriate security measures are in place when processing personal data to ensure the protection of personal data. Security measures are regularly monitored and updated in line with technological developments and legal requirements.

The processor shall inform the controller of the security measures and appropriate technical solutions in a separate document that forms an integral part of these privacy terms, which govern the legal relationship between the controller and the processor, and the Personal Data Protection Policy, which governs the legal relationship between the processor and the employees who process the personal data of individuals under a specific controller.

FINAL PROVISIONS

The Binding Nature of Legal Terms and Conditions

  • Privacy Policy apply to all operators, with whom the processor has established a legalbusiness relationship established by contract or in writing via email, and which are confirmed by the controllers via email, in which case an amendment to the existing legal relationship is deemed to have been adopted, or by a written amendment to
    an existing written contract, if the operator so requires.
  • The privacy policy is binding on all legal transactions, which are concluded on that basis.
  • The privacy policy is an integral part of the service order by the operator.
  • The administrator confirms acknowledgment and consent by accepting these privacy terms before ordering the service (in the contract or in writing via electronic communication).

Changes to the Privacy Policy

  • The data processor regularly updates the privacy policy to reflect changes in the law.
  • The processor shall notify the controller of any changes in a timely manner in writing via email.
  • The processor maintains an archive of changes to the privacy policy, which is available to any controller upon prior written request sent to the processor’s contact email address.

Dispute Resolution

The processor and the controller agree to resolve any disagreements or disputes resolve the situation calmly and by mutual agreement. If an amicable resolution is not possible, the court has jurisdiction to resolve the dispute v The Republic of Slovenia, based on the processor's location.